December 2003 - cypherpunks-legacy

Re: Java Crypto API questions
by jim bell 17 Dec '03

17 Dec '03

At 01:13 PM 6/3/96 -0400, Simon Spero wrote: >On Mon, 3 Jun 1996, jim bell wrote: >> >> But you haven't explained why somebody can't export JUST the signature. You >> know, import the software, have Sun sign it domestically, strip off everything that isn't a >> signature, and export the signature. Append it to the un-imported code >> outside the country. > >Ancillary device... It's pretty clear cut. Sure about that? Is a microprocessor an "ancillary device"? A DRAM module? A hard disk? How about an operating system, which stores and retrieves data for an encryption program? How about a BIOS? What about a keyboard? A video display? I think that any definition of "ancillary device" which is so broad as to include signatures just about has to include any any of these things too, but it won't be considered such because the government has already lost the battle on hardware exports. A signature is just that: A signature. It doesn't encrypt or decrypt. It doesn't even ALLOW the system it's in to encrypt or decrypt, because there are numerous encryption programs written that have no need for such a signature. If no program existed which _used_ that signature, nobody would think twice about exporting it. The fact is, it is LEGAL to import encryption code into the US. It is LEGAL to generate an hash of that code, and it is LEGAL to export that hash. To believe otherwise is to broadly expand the scope of export laws far beyond what they were intended to mean. Jim Bell jimbell(a)pacifier.com

1 0

[Noisy] More curfews (was Re: opinions on book "The Truth Machine")
by Rev. Mark Grant, ULC 17 Dec '03

17 Dec '03

On Sat, 1 Jun 1996, Adam Back wrote: > political climate. Having just read your post on curfews my response > was what the fuck, are you serious? It totally amazes me that public > opinion has got to the stage that something like this would be > accepted. Interesting that the day after you posted this the front-page of the UK's major newspapers carried a story about the Labour party proposing precisely the same thing in the UK. Of course the cops already have surveillance cameras all over the place. > I'm not sure where I would stand on this legally, but I have so far > resisted the temptation to tell them it's none of their business. I tried it a few weeks ago when they stopped me for a random breath test (illegal as far as I know) after following me for three miles while I scrupulously obeyed the law. They originally claimed that they had stopped me randomly, because "that's what I pay them for", but when I questioned the legality they decided that I'd crossed the centerline while passing a parked car and therefore must be drunk (even though my car was too wide to not cross the line). In other words, I don't think they care about the legal issues. Still, I suppose it's better than being stopped for "driving at 2:30 in the morning" again. Hmm, who said the UK didn't have a curfew already? > They are I think > talking about making it law that all target pistols must be kept at > the gun club (whereas currently you can take them home to clean (but > not shoot)). Gun-thieves will love that one. Why steal them one at a time when you can steal twenty or thirty in one go? Mark "Out of Europe in a few more days" Grant

1 0

Re: Security of PGP if Secret Key Available?
by Henry Huang 17 Dec '03

17 Dec '03

On Jun 3, 2:36, "Robert A. Hayden" wrote: > However, I got to wondering about the security of PGP assuming somebody > trying to read my PGPed stuff has my 1024-bit secret key. ie, if I have > it on my personal computer, and somebody gets my secret key, how much > less robust has PGP just become, and what are appropriate and reasonable > steps to take to protect this weakness? If someone else has your secret key, it's safe to assume you're toast. ;) Better a new key and revocation certificate before the forgeries start (or before someone ELSE does before you ... <shudder>). More specifically, if you've failed to assign a passphrase to your secret key, you ARE toast, because anyone can just pick it up and use it. If you did use a passphrase, it becomes a question of breaking either the passphrase, or the IDEA algorithm used to encrypt your secret key. It's usually a lot easier to break the passphrase than it is to brute force IDEA. See the PGP Passphrase FAQ (http://www.stack.urc.tue.nl/~galactus/remailers/passphrase-faq.html) and Arnold Reinhold's page (http://world.std.com/~reinhold/papers.html) for more details. -H

1 0

Re: Java Crypto API questions
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 2:17 6/3/96, Jeff Weinstein wrote: >> Sun can export the signature though. The vendor already has the package, >> they just need the sig/cert... > > Not likely. Sun will probably be required to agree not to do this >as a condition of exporting software with "pluggable crypto". Software >with hooks for crypto functions is treated the same as the actual crypto >as far as the ITAR is concerned. Then how can Sun claim that their system is 1. Exportable 2. Does RC-4 and DES? The Java Crypto AIP presentation slides that are available on Sun's website clearly make both claims. Unfortunately, the feedback address that Sun provides in the slides is unknow to their mailserver (at least it was last week) and no further information seem to be avaiable about their "public and open" policy. Confused, Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Why PGP isn't so ubiquitous (was NRC Session Hiss)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 21:33 6/2/96, Deranged Mutant wrote: >The reasons PGP hasn't become widely used are because of it's lack of >user-friendliness and poor integration into other tools, irregardless >of S/MIME. I concur. It is that lack of integration that gave S/MIME the space to grow in. Now it is too late to achieve the market dominance that PGP should have achieved long ago. S/MIME *will* be the email encryption standard used by Joe Sixpack. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

DEMOGRAPHICS v. ANONYMITY
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, At 07:19 AM 6/3/96 +0200, "Senator Exon" wrote: >... demographic data on big spenders is worth more than >anonymous cash from people who buy packages of gum. Much >more. A true, but irrelevant. The correct dichotomy is between demographic data on big spenders and anonymous big spenders. Yes, it would be nice to have demographics on everyone, but demographics are secondary to sales. >An economy of big spenders is worthless unless they're in >your store. The cards give evidence of who spends in your >store, so you target your advertisements accordingly. Of course, there are other ways to get demographics and other ways to target advertising and other ways to get big spenders into your store. >I also shop only with cash, here and elsewhere. >Double-blinded e-cash will be the only way to go, if it >ever is the way to go. And I bet they don't turn down your cash just because it contains no demographic data. Thus demonstrating the pragmatism of the market with regard to anonymity. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: Java Crypto API questions
by br＠doppio.Eng.Sun.COM 17 Dec '03

17 Dec '03

Martin Minow (minow(a)apple.com) writes: [...] |-- Policies = Assertions + Capabilities. That's what my notes Policies are statements like: "code endorsed by any one of the following signatures (say three of my friends) can access the public part of my file system" This is hard. It's probably not going to make it in the first release. The simple first pass is to say "code signed by x, y, and z" can do whatever it wants. |-- Feedback to security-api(a)java.sun.com. The alias had some trouble over the week-end. It should be working fine now. -- Benjamin

3 2

PGP's ubiquity (was Re: NRC Session Hiss)
by Bruce Baugh 17 Dec '03

17 Dec '03

At 09:15 PM 6/2/96 -0700, Lucky Green wrote: >That PGP is ubiquitous is subject to discussion. PGP is widely available, >but that doesn't mean that it is widely used. What percentage of email is >PGP encrypted? Less than half a percent? Much, much less than that. I get about five hundred messages a day. On the average day, none of them are PGP-encrypted. On the average _week_, none of them are PGP-encrypted. And by virtue of having a PGP key signed and on the servers, I'm better prepared to send and receive such mail than at least 99.9% of the net.population. >PGP was a failure in the mass market, regardless how popular it may be >with some subscribers of this list. True, and important. In one sense it doesn't matter how good a security system is if a manageable set of people are the only ones using it. There are only a few thousand IDs in the key servers, and vast majority of those, I'd guess, are like me in not using PGP routinely. But even if we were, the institutions of the State have experience in the long-term surveillance of groups quite a bit larger than us. This is where I think some forms of cyber-elitism fail. So I've got access to darned good tools. The State has numbers and resources, and memes about how the masses do right when they acquiesce, on its side. We are not, I think, particularly secure in an environment where the very fact of using secure tools stands out from the herd. But what the herd needs are good tools with good simple front ends, and a) those who design the tools generally don't care about the herd and so do nothing to get outside the crypto ghetto and b) those in a position to design the front ends generally have more immediately rewarding things to do or don't know about the tools themselves. Five years ago I was quite optimistic about strong security as an important element in bringing about the post-statist society I desire. Now I'm pessimistic. I just don't see signs of the stuff spreading sufficiently. And while S/MIME has interesting features (based on what I've read so far), the default 40-bit setup is basically no protection at all. And I know just how hard it is to get people comfortable using non-default features. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

1 0

Crypto APIs Considered Harmful
by tcmay＠got.net 17 Dec '03

17 Dec '03

A typo when I wrote: 2. Eliminates a reason for controlling the distribution and export of browsers, mailers, newsreaders, etc. Imagine the glum reaction of the NSA when they realize that they can't control these programs, because the "crypto hooks" are only the hooks to basic message payloads...and they control these. ^ *can't* I meant to include the "can't." A Web browser with no hooks for crypto absolutely will not be export-controlled. But if users in Slovakia and Beninia can _see_ the messages, as they of course can, then crypto programs they supply themselves can of course see and act on the messages. (Copying to a clipboard, for example, and lots of other ways.) No way the NSA can control that. Concentrating on integrating crypto tightly into commercial programs is playing the NSA's game. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Java Crypto API questions
by br＠doppio.Eng.Sun.COM 17 Dec '03

17 Dec '03

|Unfortunately, the feedback address that Sun provides in the slides is |unknow to their mailserver (at least it was last week) and no further |information seem to be avaiable about their "public and open" policy. In the actual talk, I said "will be public and open", that is when we actually announce the policy it will be public and open. The things that are certain about it is that it will be constrained only by export considerations, and that we'll sign competitors' packages. I am hoping that I can get a spec document for the API ready by the end of the month. By then we will have more details regarding the export stuff. In the meantime, I'll see if we can get an interim FAQ together. The security-api(a)java.sun.com address should be working now. -- Benjamin

1 0